This threat is a supply-chain attack targeting developers using Polymarket-related npm packages published by the maintainer polymarketdev (GitHub actor texsellix). Within a short time window, nine packages were published that contain identical malicious code in dist/index.js. The postinstall script detects interactive terminals to prompt for Ethereum private keys or silently reads the PRIVATE_KEY environment variable from .env files. It persists locally by creating a hidden directory with device and wallet metadata and exfiltrates stolen keys via HTTPS POST requests to a Cloudflare Worker C2 endpoint, including a device fingerprint header. The packages wrap legitimate Polymarket CLOB SDK and related libraries to provide functional trading commands, misleading users about key security. The campaign targets developers using LLM-assisted coding workflows by naming packages to appear relevant and trustworthy.

Systems with these malicious packages installed are fully compromised. Ethereum private keys stored in environment variables or entered interactively are stolen and sent to an attacker-controlled server, risking theft of cryptocurrency assets. The malware establishes local persistence and device fingerprinting, enabling ongoing unauthorized access. Removal of the packages does not guarantee full remediation due to potential additional malicious artifacts. Developers relying on these packages risk credential theft and subsequent asset loss.

Immediate removal of all polymarketdev npm packages is required. All Ethereum private keys and related secrets stored on affected systems must be rotated immediately from a secure, uncompromised environment. Due to the potential for full system compromise, consider rebuilding affected systems. Monitor for any unauthorized transactions or access to Ethereum wallets associated with compromised keys. No official patch or fix is available; remediation relies on removal and secret rotation.